LiveAuctioneers Data Breach (2020): What Was Exposed & What To Do

Breaking down the breach

The incident occurred at LiveAuctioneers, an online antiques marketplace. Public reporting on 19 June 2020 stated that 3.4 million records had been obtained and were being offered for sale. The material was subsequently shared more widely. Passwords were stored as unsalted MD5 hashes. No further technical details on the method of access or the exact date range of the intrusion have been disclosed. The data set was later supplied to Have I Been Pwned by breachbase.pw.

How a breach like this happens

Marketplaces that store user accounts are frequent targets because they hold structured records that combine contact information with authentication data. Attackers commonly exploit unpatched software, weak access controls or compromised third-party services to extract database contents. Once obtained, the material is often packaged and sold on forums or dark-web marketplaces, after which copies circulate among multiple actors. Passwords hashed without salts are especially susceptible to offline cracking tools that test large wordlists against the entire set.

Who is LiveAuctioneers?

LiveAuctioneers operates an online platform that connects bidders with auction houses specialising in antiques, collectibles and art. Users create accounts to place bids, receive notifications and manage purchases. Such services routinely retain names, email and physical addresses, telephone numbers and login credentials to support transactions and customer service. A breach at this scale therefore exposes data that can be used for targeted contact or account takeover attempts across other sites where the same credentials may have been reused.

What was likely exposed

The records included the following categories of information:

• Email addresses
• IP addresses
• Names
• Passwords stored as unsalted MD5 hashes
• Phone numbers
• Physical addresses
• Usernames

Exact confirmation of every field present in every record remains limited to the summary provided with the data set.

The real-world impact

Individuals may receive unsolicited messages or see attempts to access accounts on other services if the exposed passwords match credentials used elsewhere. Physical addresses and telephone numbers can facilitate more precise phishing or social-engineering campaigns. For the organisation, the incident created reputational and operational costs associated with notifying users, resetting accounts and addressing subsequent misuse of the data. Because the passwords were stored without salts, any reuse of those credentials increases the likelihood of successful automated attacks.

If your data was in this breach

Begin by changing the password on any LiveAuctioneers account and on any other service where the same password or a close variation was used. Enable multi-factor authentication wherever available. Review recent account activity for signs of unauthorised access. Readers can run a free exposure scan of their email address against known breach data sets to determine whether their information appears in this or other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.